Disallow Capabilities (Strict)

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: disallow-capabilities-strict
 5  annotations:
 6    policies.kyverno.io/title: Disallow Capabilities (Strict)
 7    policies.kyverno.io/category: Pod Security Standards (Restricted)
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/minversion: 1.6.0
10    kyverno.io/kyverno-version: 1.6.0
11    kyverno.io/kubernetes-version: "1.22-1.23"
12    policies.kyverno.io/subject: Pod
13    policies.kyverno.io/description: >-
14      Adding capabilities other than `NET_BIND_SERVICE` is disallowed. In addition,
15      all containers must explicitly drop `ALL` capabilities.
16spec:
17  validationFailureAction: Audit
18  background: true
19  rules:
20    - name: require-drop-all
21      match:
22        any:
23        - resources:
24            kinds:
25              - Pod
26      preconditions:
27        all:
28        - key: "{{ request.operation || 'BACKGROUND' }}"
29          operator: NotEquals
30          value: DELETE
31      validate:
32        message: >-
33          Containers must drop `ALL` capabilities.
34        foreach:
35          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
36            deny:
37              conditions:
38                all:
39                - key: ALL
40                  operator: AnyNotIn
41                  value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
42    - name: adding-capabilities-strict
43      match:
44        any:
45        - resources:
46            kinds:
47              - Pod
48      preconditions:
49        all:
50        - key: "{{ request.operation || 'BACKGROUND' }}"
51          operator: NotEquals
52          value: DELETE
53      validate:
54        message: >-
55          Any capabilities added other than NET_BIND_SERVICE are disallowed.
56        foreach:
57          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
58            deny:
59              conditions:
60                all:
61                - key: "{{ element.securityContext.capabilities.add[] || `[]` }}"
62                  operator: AnyNotIn
63                  value:
64                  - NET_BIND_SERVICE
65                  - ''